Able to delete passwords without giving a password, even if "Require device sign in" is enabled.
Categories
(Toolkit :: Password Manager, defect)
Tracking
()
People
(Reporter: u753344, Unassigned)
References
Details
Attachments
(1 file)
|
299.34 KB,
video/mp4
|
Details |
User Agent: Mozilla/5.0 (Windows NT 10.0; Win64; x64; rv:127.0) Gecko/20100101 Firefox/127.0
Steps to reproduce:
- Enable "Require device sign in to fill and manage passwords" in the Privacy settings.
- Go to "about:logins" to view the saved password list.
- Successfully delete a password without getting asked for the Windows user password.
Actual results:
The password was deleted, without me having to input the MS Windows password, to verify that it's actually me.
Expected results:
The browser should show up a window, in which you have to input your Windows password in order to delete it.
|
||
Comment 1•1 year ago
|
||
The Bugbug bot thinks this bug should belong to the 'Toolkit::Password Manager' component, and is moving the bug to that component. Please correct in case you think the bot is wrong.
|
||
Comment 2•1 year ago
|
||
Marking issue as New as I was able to reproduce the issue using the steps from description on Win11 FF build 127.0. User is able to remove the account from about:logins without being asked about the system password.
I have the same issue. For me, this setting does not work in any case. An OS authentication is not required, except to enable or disable this feature. I'm able to fill and manage passwords (add, modify, delete) without authenticating.
Description
•